15 ms·

Passkeys: They're not perfect but they're getting better

55 points by ashergill 11mo ago

commandersaki 11mo ago
Passkeys are a convenient second form of authentication that goes overlooked when accounts are hacked.
rstuart4133 11mo ago
For me, passkey's have made it when I can pay several different, independent providers to store them for me, and authorise the devices I can put them on. To expand on that a bit, I don't have a problem with banks or whoever insisting they be stored securely. That means I don't have a problem win the inference that they don't trust me to store or even see my own keys. What I do have a problem with is not being able to back them up. Which means I have a problem with Apple, Google or even Bitwarden handing me out a free they can take away at any time. Fix that, so I can have store my identity(ies) at multiple providers, and I happy.
vivzkestrel 11mo ago
if you really want passkeys to succeed why not implement it at the browser level. Basically everytime you visit a new website the browser has never seen before, the browser initiates a handshake of sorts with that website and secures a passkey for it which is stored. If the user wants to log in to that website, the browser can automatically patch in the details as and when required
hollow-moe 11mo ago
Websites can choose to not accept your passkey manager ("accept" not "block" since it will obviously be enforced as whitelist). What could possibly go wrong ? If only there was a similar example with an existing system like TOTP and a big company like Steam.......... Link unrelated https://github.com/keepassxreboot/keepassxc/discussions/9591 https://github.com/keepassxreboot/keepassxc/discussions/9591 Eventually get debanked and go live in the woods ig
taccal 11mo ago
[flagged]
angry_octet 11mo ago
I particularly dislike that Teams forces you to use Microsoft Authenticator for Passkeys, instead of a physical FIDO2 or Apple/Google Passkeys.
angry_octet 11mo ago
I look forward to info stealers dumping Passkey apps and leakage via additional device enrollment, and not having clear mechanisms for rolling all your Passkeys. Device attestation and signing transparency logs are quite necessary for users to have visibility of where/when Passkeys have logged in. Really they should also have key ratcheting so stolen keys become useless.
hamonrye 11mo ago
[dead]
supermatt 11mo ago
The problem with passkeys is that device/OS and browser vendors (or more specifically: Apple, Google and Microsoft) are trying to use it as an excuse to lock in users. There is no reason a passkey can’t be portable - even the so called “device bound” credentials these vendors are claiming prevent export are actually implemented as credentials synchronised throughout their own ecosystems - i.e multi device. NOTHING in the FIDO2/WebAuthn spec forbids user controlled portability. It’s just bigtech trying to make it harder to leave their ecosystems - and when passkeys become widely adopted you won’t be able to log into those sites/apps without some form of recovery on a case by case basis should you decide to switch from Apple to android, windows to Mac, etc.
senin6588 11mo ago
[flagged]
physicsguy 11mo ago
When they first came about it seemed like some websites didn’t work well with them and insisted on using the device password manager. I use BitWarden for everything so didn’t want to get into that - I want to be able to log into things on my personal and work Macs in Chrome, Safari on iOS, etc etc. Since then though it’s rare I’ve run into issues like that, and the login flow is much better in sites that have adopted it. I did hit an issue in GitHub last week where after logging into things with passkey it then immediately wanted me to MFA which could use the same passkey. But these things are getting rarer.
shortsunblack 11mo ago
Android to this day does not support CTAP 2.1, hence it does not support hardware-bound passkeys with PIN via NFC as transport. You can only do PIN via USB. Google does not care about FIDO or standards compliance. They care about vendor lock-in their proprietary passkey offerings allow.
oldestofsports 11mo ago
So then I should store all my passkeys in a vault that I protect with a single password, how are passkeys safer?
- AlexandrB 11mo ago
  The better question is: how are passkeys safer given that the recovery flow will be the same SMS or email based approach everyone uses today?
- etskinner 11mo ago
  Let's assume your vault/login has these properties: - You have a strong unlock password that you don't use anywhere else - You have a second factor set up for unlocking the vault (TPM in the device you're using, Yubikey, TOTP, etc.) - The service you're logging into has good account recovery hygeine The benefit, assuming those things, is that the passkey is phishing-resistant and social-engineering-resistant. If a user gets an email saying "omg, someone tried to transfer your paypal, click this link to log in", then when they try to log in with the passkey, the site the attacker is using won't be able to use the passkey (because the passkey is associated with a particular domain). Even if the user wanted to bypass this, there's specifically no way for them to extract the contents of the passkey. That is very different from a user having their password stored in their vault. They could easily forget to check the domain, or get tricked by a very similar looking one, and copy/paste their password into the attacker's form.
  - abdullahkhalids 11mo ago
    My password manager (keepassxc) has a browser extension that only lets you autocomplete the password on a page if the url matches the one stored in the database. Sure I could manually copy the password from the database, but in practice, this is fairly good security. It also doesn't treat the user as an always-idiot, which is a good thing in my book.
    - skybrian 11mo ago
      That works for you, but the website doesn't know you use a password manager, so they'll often want you to use SMS as a second factor. Passkeys require some kind of password manager. That's the main benefit. The adoption problems are because a lot of users don't really understand password managers.
deleted 11mo ago
[deleted]
varbhat 11mo ago
I agree. I use Bitwarden on my Samsung Android phone and also on my Linux desktop. Bitwarden currently supports passkeys on almost all the apps on my android including firefox. The same passkeys which i used to login on my phone can be used on my Linux desktop where i use Firefox with Bitwarden extension. What's now possible was not even possible at the start of this year. I haven't switched everything to passkeys but i can see it as an alternative to passwords now(passwords really shines in some areas too). I read about Passkey comittee being against open source passkey managers during start of this year (can't reference it, sorry) but with open source password/key managers already supporting passkeys, i don't think it turned out to be true.
- abdullahkhalids 11mo ago
  So the same passkey is being used on multiple devices, rather than different devices (actually applications) having distinct passkeys. Doesn't that defeat one of the centrals aims of passkeys? In what ways is your setup different than random passwords in bitwarden - what's the additional security?
  - greenicon 11mo ago
    Passkeys cannot be phished. Other than that they shouldn't have a big advantage for a more professional user with unique, long, and random passwords. For the common user it should be a great upgrade, giving all these advantages with better UX.
    - eviks 11mo ago
      Password autofill also provides that protection as it won't match on phishing domain
    - ianburrell 11mo ago
      Another is that passkeys are single login and sites don’t use 2FA. Not having to get out TOTP or receive SMS is worth it. Basically, any site that does 2FA should take passkeys.
nabla9 11mo ago
Losing your device and not having any passwords is like losing your fingerprints. >Device loss scenarios >Users are largely unsure about the implications for their passkeys if they lose or break their device, as it seems their device holds the entire capability to authenticate. To trust passkeys as a replacement for the password, users need to be prepared and know what to do in the event of losing one – or all – of their devices. >Backing up and synchronising passkeys with a Credential Manager makes it easier to recover access to them compared to other existing second factor options. However, this relies on the user having prepared their Credential Manager account for recovery. Users need help in understanding and implementing the right steps so they can feel ready to go passwordless and use passkeys without extra worry and hassle.
- burnte 11mo ago
  Just not having the right device with you is crippling. IMO Passkeys need more work. I'd really like to see accounts support multiple passkeys. I'd prefer biometrics that are device independent. I just don't like the idea of replacing something someone can steal (a password) with something else someone can steal (a phone).
  - tzs 11mo ago
    > I'd really like to see accounts support multiple passkeys Most accounts seem to. Personally, I think I've only found one or two out of around 25 that I've added passkeys to that would not let me add more.
  - torstenvl 11mo ago
    Would be nice, but biometrics have also been systematically made less secure. Apple, for example, no longer sells a phone with Touch ID.
    - burnte 11mo ago
      Vendors not using biometrics well doesn't mean biometrics are insecure. Apple not selling touch ID CERTAINLY isn't evidence of the security of biometrics.
JohnFen 11mo ago
I'm glad that someone is at least seriously talking about these problems. A couple of them are serious enough to make passkeys a real pain in the butt for me. A big enough one that the whole scheme is a nonstarter.
lknuth 11mo ago
Speaking of passkeys, could they be used to authenticate to a local application - say for unlocking a password vault (perhaps through a Yubikey)?
- angry_octet 11mo ago
  They could, it's just an API.
- shortsunblack 11mo ago
  Yes. HMAC extension allows for this use case.
- dist-epoch 11mo ago
  Probably not. But YubiKey supports multiple protocols, one of them surely could work for your use case.
runningmike 11mo ago
“Passkeys are the future of authentication” …this is not the future I hope….When Google, Microsoft and a lot of other B*G-Tech companies promote Passkeys, you know it is not done to protect your security and privacy. Nice read https://techrights.org/n/2025/05/02/Passkeys_Are_Vendor_Lock_in_and_Imperialism_Not_Security_So_Esc.shtml https://techrights.org/n/2025/05/02/Passkeys_Are_Vendor_Lock...
g-clef 11mo ago
Until passkeys can pass the test of "my non-technical friends and family don't call me for help about them", passkeys aren't ready. Vendors keep making assumptions about how users behave which are not safe assumptions, and that keeps blowing up the interactions of non-technical users. (I'm sure there's an "assumptions developers make about user accounts" blog out there somewhere.) For example, my family has had to call me for help on the interaction between passkeys on Apple & Amazon multiple times. They have a shared Amazon account, which neither Amazon nor Apple seem to like. The first problem came when they didn't even know they'd been moved to passkeys - there was a popup that one of them didn't understand, they clicked OK to get it to go away, and suddenly the other partner can't log in, and neither of them can figure out how to log into Prime Video on their AppleTV. Another time one of them got "nudged" to add a fingerprint to the account, again freezing out the other person. Until that nonsense stops happening, Passkeys aren't ready.
- stavros 11mo ago
  By that metric, passwords are even less ready, as I seem to always have to field calls for passwords getting stolen or compromised or accounts getting phished. I guess we're back to faxing ID.
  - rekabis 11mo ago
    I have a non-technical father with dementia, and passwords+TOTP are almost frictionless for him, with minor exceptions. We are able to share around passwords and TOTP codes without any problems so I can properly monitor his online activities to keep him out of trouble. He’s a cranky old guy with almost zero trust, so having to input all that stuff satisfies him that security is being employed. Passcodes just freak him out.
    - stavros 11mo ago
      I think Github is basically the only good passkey implementation right now. The ideal flow should be: * Click login button * Window pops up asking you which passkey you want to use, you click the one you want * You're in Anything on top of that is just added friction, and I haven't seen many sites get it right.
noirscape 11mo ago
At its core, the main drawbacks that need to be solved for them to be a viable option are imo: * Improving OS flows. Every passkey implementer that's also an OS gets really excited about enrolling you into their proprietary clouds, and using alternate flows to respect the users wish to use their own manager is usually hidden in confusing UI forms that don't feel consistent if you don't already know what you're doing. * Device loss scenario is already mentioned, although more broadly speaking a lot of the reasons people get leery is because all three major providers (Google, Microsoft, Apple) are notorious for their near black box technical support. Losing access to one of these providers on its own is already enough to heavily disrupt the average person's life. Having your login details stored with them makes this even worse. * The FIDO Alliance Is Way Too Excited About Device Attestation And I Don't Like It. Basically the FIDO Alliance's behavior around passkeys reeks of security theater and them badgering an open source password manager for daring to let users export their passkeys in the format they preferred, rather than what the FIDO Alliance wanted (which is that passkeys must always be encrypted with a password) is telling. If they are as secure as promised, it's a bad look to start threatening device attestation as a means to get people to comply with your specific idea of security. The only real barrier right now to it outright being a thing is that Apple zeroes out the field and when Apple is the only meaningful halt to that kind of attestation, something has gone very wrong. I think passkeys are interesting, but I just flat out don't trust the FIDO Alliance with the idea. They're way too invested in big tech being good stewards of the ecosystem, which is becoming increasingly unpalatable as more and more evidence piles up that they're really bad actors on everything else. (So why should we trust them with our credentials?) The idea genuinely has value (it's literally the same kind of mechanism as SSH keys), but the hostility towards user freedom is deeply concerning and a blocker to getting people to use it. Even non-technical people seem leery of them, just because of how aggressively big tech has been pushing it.
- AlexandrB 11mo ago
  > * Improving OS flows. Every passkey implementer that's also an OS gets really excited about enrolling you into their proprietary clouds, and using alternate flows to respect the users wish to use their own manager is usually hidden in confusing UI forms that don't feel consistent if you don't already know what you're doing. You're kidding yourself if you think that this is something Microsoft, Apple, or Google are incentivized to solve. Microsoft is especially bad here - pushing their crappy products in Windows every chance they get. Once some marketing director gets the idea that this can improve retention in Outlook or something the UI will get more confusing and the dark patterns will get darker.
sam_lowry_ 11mo ago
How are passkeys different from API keys or just random chains of characters? And why can't we have the use of such keys enforced by an EU legislation so that all businesses allow users to login using such strings of random characters? The world would then be a better place.
- gowld 11mo ago
  > How are passkeys different from API keys or just random chains of characters? Passkeys are encrypyed so they can't be simply copied off your device.
  - angry_octet 11mo ago
    They can most definitely be copied off the device, and the decryption key is in memory.
  - sam_lowry_ 11mo ago
    So how are they better than API keys if I can not even backup them?
- IcyWindows 11mo ago
  Passkeys are a private key stored on your device with the public key registered with the server. Servers should allow multiple passkeys per user (so you can register multiple devices), but many don't.
  - sam_lowry_ 11mo ago
    That's an implementation detail users should not care about. The bigger question is... why don't we replace the login/password combination with just a string of randomly generated characters and call it a day? Why protect these strings of random characters from users, call them passkeys and advertise them on all street corners? Feels like a devil's plot to strip us from all the rights to our devices.
    - 11mo ago
jauntywundrkind 11mo ago
Nicely timed on the one year anniversary of FIDI Alliance's Credential Exchange Protocol and Credential Exchange Format. https://fidoalliance.org/fido-alliance-publishes-new-specifications-to-promote-user-choice-and-enhanced-ux-for-passkeys/ https://fidoalliance.org/fido-alliance-publishes-new-specifi... https://news.ycombinator.com/item?id=41847787 https://news.ycombinator.com/item?id=41847787 But afaik you still can't move Passkeys from Chrome or Safari to any other credential manager. I was vaguely under the impression that there was a ton of push-back again import/export flows in general, that the CEP was going to be the only supported path. And it requires that your Credentials Manager have a public endpoint to send your credentials to. Which doesn't force but radically ups the challenge for individuals to self host or manage things themselves, will drive Passkeys to remain service provided only. With governments upping their right to snoop, immoral intercept, it's hard to have too much hope that Passkeys can remain trustable & respectable. If the UK passes a law saying they can access all your keys, the odds are not in your favor that Google is going to make a Signal like stand & tell the UK to buzz off. It's unfortunate that these giant massive enterprises are so big are so many products all in one, because if there was a healthy Chrome business not tied to thousands of other profit lines, maybe Chrome would dare have some backbone & tell their majesty to go stick it where the sun don't shine. But these companies are so big that even the most immoral outrageous ridiculous laws end up being accepted. Passkeys seems like a huge painted target; maybe the next 15-20 years go by with no one trying to get in the cookie jar, but it seems inevitable that the moral rot and illegitimacy of governments will stoop down to making this good idea untenable & a joke, in a long enough time scale. Especially with the service-provider-only ecosystem that's being engineered and imposed here.
ajnin 11mo ago
> websites which [...] also want to know how the passkey is being handled by the user’s device to keep their accounts safe This is exactly where passkeys go too far. "to keep their accounts safe" is always the excuse used to reduce the freedoms of users. Web sites have no business deciding how things are handled on user devices but it's precisely what passkeys enable. The boundary of control of a website used to stop at the interface between the site and the user. Now that boundary will extend to the devices. The idea of property and ownership is attacked again. The device is not something the user owns and has full control over but something that is a gateway to access content controlled by the big Internet companies. Knowing this, how long until Netflix, Disney other content providers (sorry I don't know which ones are popular right now) demand use of a passkey originating form a device with a Trusted Platform (aka Untrusted User) Module ? This is part of a long plan initiated years ago with Windows TPM requirements, Microsoft account requirements. The gap between closed and open platforms will widen and the path is clearly to apply the Smartphone model where everything is closed, controlled, DRM'd, to other computers. We're lucky the IBM PC architecture was an open one but the war on that is on.
- stavros 11mo ago
  I've seen this argument many times, but I don't understand it. Can you explain a scenario where this would be an issue? So, Netflix makes me log in with a passkey that comes from their own hardware, instead of my password manager. What's the danger there, beyond the fact that this seems to me extremely unworkable because I'd just never sign in?
  - array_key_first 11mo ago
    The danger is that you now can no longer use netflix without they're approved hardware? Of course, that's essentially already the case with netflix, but this becomes dicey when services that actually matter take this approach. And then suddenly you're debanked.
    - stavros 11mo ago
      No, we're talking about logins, not usage. Can someone explain to me a case where logging in only with an approved authenticator would be problematic?
djoldman 11mo ago
> Users are largely unsure about the implications for their passkeys if they lose or break their device, as it seems their device holds the entire capability to authenticate. To trust passkeys as a replacement for the password, users need to be prepared and know what to do in the event of losing one – or all – of their devices. > Backing up and synchronising passkeys with a Credential Manager makes it easier to recover access to them compared to other existing second factor options. However, this relies on the user having prepared their Credential Manager account for recovery. Users need help in understanding and implementing the right steps so they can feel ready to go passwordless and use passkeys without extra worry and hassle. The benefit to the user of a passkey is that they don't have to remember passwords ("what you have" and not "what you know"). But if you lose what you have, you're screwed. There's no straightforward way to mitigate this. Proposed solutions I've seen just add an extra layer of "what you know," but this just changes the security back to "what you know" if it supersedes the passkey.
supportengineer 11mo ago
Passkeys are great because they get sync'ed to all your devices, which makes it really easy to share access to those websites with other people ( who have access to devices on your account ). Like a spouse.
- marssaxman 11mo ago
  What mechanism makes that happen?
  - deleted 11mo ago
    [deleted]
- angry_octet 11mo ago
  This is also a problem because the security boundary of passkey security is now the entire cloud of that provider... And every app on every device you're logged in to.
- Bolwin 11mo ago
  Uh huh. And what if they don't? Or what if they do but would rather user their own device. Or what if they don't right now? You know what's even easier? Sending them the password.
- Mindwipe 11mo ago
  > Passkeys are great because they get sync'ed to all your devices, which makes it really easy to share access to those websites with other people ( who have access to devices on your account ). Like a spouse. They certainly fucking don't. I also have no interest in my credentials touching any cloud whatsoever.
eric1west 11mo ago
[flagged]
donald6 11mo ago
[flagged]
smthglbert7 11mo ago
[dead]

55 points by ashergill 11mo ago

Passkeys are a convenient second form of authentication that goes overlooked when accounts are hacked.

For me, passkey's have made it when I can pay several different, independent providers to store them for me, and authorise the devices I can put them on. To expand on that a bit, I don't have a problem with banks or whoever insisting they be stored securely. That means I don't have a problem win the inference that they don't trust me to store or even see my own keys. What I do have a problem with is not being able to back them up. Which means I have a problem with Apple, Google or even Bitwarden handing me out a free they can take away at any time. Fix that, so I can have store my identity(ies) at multiple providers, and I happy.

vivzkestrel 11mo ago

if you really want passkeys to succeed why not implement it at the browser level. Basically everytime you visit a new website the browser has never seen before, the browser initiates a handshake of sorts with that website and secures a passkey for it which is stored. If the user wants to log in to that website, the browser can automatically patch in the details as and when required

hollow-moe 11mo ago

Websites can choose to not accept your passkey manager ("accept" not "block" since it will obviously be enforced as whitelist). What could possibly go wrong ? If only there was a similar example with an existing system like TOTP and a big company like Steam.......... Link unrelated https://github.com/keepassxreboot/keepassxc/discussions/9591 https://github.com/keepassxreboot/keepassxc/discussions/9591 Eventually get debanked and go live in the woods ig

taccal 11mo ago

[flagged]

angry_octet 11mo ago

I particularly dislike that Teams forces you to use Microsoft Authenticator for Passkeys, instead of a physical FIDO2 or Apple/Google Passkeys.

angry_octet 11mo ago

I look forward to info stealers dumping Passkey apps and leakage via additional device enrollment, and not having clear mechanisms for rolling all your Passkeys. Device attestation and signing transparency logs are quite necessary for users to have visibility of where/when Passkeys have logged in. Really they should also have key ratcheting so stolen keys become useless.

hamonrye 11mo ago

[dead]

supermatt 11mo ago

The problem with passkeys is that device/OS and browser vendors (or more specifically: Apple, Google and Microsoft) are trying to use it as an excuse to lock in users. There is no reason a passkey can’t be portable - even the so called “device bound” credentials these vendors are claiming prevent export are actually implemented as credentials synchronised throughout their own ecosystems - i.e multi device. NOTHING in the FIDO2/WebAuthn spec forbids user controlled portability. It’s just bigtech trying to make it harder to leave their ecosystems - and when passkeys become widely adopted you won’t be able to log into those sites/apps without some form of recovery on a case by case basis should you decide to switch from Apple to android, windows to Mac, etc.

senin6588 11mo ago

[flagged]

physicsguy 11mo ago

When they first came about it seemed like some websites didn’t work well with them and insisted on using the device password manager. I use BitWarden for everything so didn’t want to get into that - I want to be able to log into things on my personal and work Macs in Chrome, Safari on iOS, etc etc. Since then though it’s rare I’ve run into issues like that, and the login flow is much better in sites that have adopted it. I did hit an issue in GitHub last week where after logging into things with passkey it then immediately wanted me to MFA which could use the same passkey. But these things are getting rarer.

shortsunblack 11mo ago

Android to this day does not support CTAP 2.1, hence it does not support hardware-bound passkeys with PIN via NFC as transport. You can only do PIN via USB. Google does not care about FIDO or standards compliance. They care about vendor lock-in their proprietary passkey offerings allow.

oldestofsports 11mo ago

So then I should store all my passkeys in a vault that I protect with a single password, how are passkeys safer?

AlexandrB 11mo ago
The better question is: how are passkeys safer given that the recovery flow will be the same SMS or email based approach everyone uses today?
etskinner 11mo ago
Let's assume your vault/login has these properties: - You have a strong unlock password that you don't use anywhere else - You have a second factor set up for unlocking the vault (TPM in the device you're using, Yubikey, TOTP, etc.) - The service you're logging into has good account recovery hygeine The benefit, assuming those things, is that the passkey is phishing-resistant and social-engineering-resistant. If a user gets an email saying "omg, someone tried to transfer your paypal, click this link to log in", then when they try to log in with the passkey, the site the attacker is using won't be able to use the passkey (because the passkey is associated with a particular domain). Even if the user wanted to bypass this, there's specifically no way for them to extract the contents of the passkey. That is very different from a user having their password stored in their vault. They could easily forget to check the domain, or get tricked by a very similar looking one, and copy/paste their password into the attacker's form.
- abdullahkhalids 11mo ago
  My password manager (keepassxc) has a browser extension that only lets you autocomplete the password on a page if the url matches the one stored in the database. Sure I could manually copy the password from the database, but in practice, this is fairly good security. It also doesn't treat the user as an always-idiot, which is a good thing in my book.
  - skybrian 11mo ago
    That works for you, but the website doesn't know you use a password manager, so they'll often want you to use SMS as a second factor. Passkeys require some kind of password manager. That's the main benefit. The adoption problems are because a lot of users don't really understand password managers.

deleted 11mo ago

[deleted]

varbhat 11mo ago

I agree. I use Bitwarden on my Samsung Android phone and also on my Linux desktop. Bitwarden currently supports passkeys on almost all the apps on my android including firefox. The same passkeys which i used to login on my phone can be used on my Linux desktop where i use Firefox with Bitwarden extension. What's now possible was not even possible at the start of this year. I haven't switched everything to passkeys but i can see it as an alternative to passwords now(passwords really shines in some areas too). I read about Passkey comittee being against open source passkey managers during start of this year (can't reference it, sorry) but with open source password/key managers already supporting passkeys, i don't think it turned out to be true.

abdullahkhalids 11mo ago
So the same passkey is being used on multiple devices, rather than different devices (actually applications) having distinct passkeys. Doesn't that defeat one of the centrals aims of passkeys? In what ways is your setup different than random passwords in bitwarden - what's the additional security?
- greenicon 11mo ago
  Passkeys cannot be phished. Other than that they shouldn't have a big advantage for a more professional user with unique, long, and random passwords. For the common user it should be a great upgrade, giving all these advantages with better UX.
  - eviks 11mo ago
    Password autofill also provides that protection as it won't match on phishing domain
  - ianburrell 11mo ago
    Another is that passkeys are single login and sites don’t use 2FA. Not having to get out TOTP or receive SMS is worth it. Basically, any site that does 2FA should take passkeys.

nabla9 11mo ago

Losing your device and not having any passwords is like losing your fingerprints. >Device loss scenarios >Users are largely unsure about the implications for their passkeys if they lose or break their device, as it seems their device holds the entire capability to authenticate. To trust passkeys as a replacement for the password, users need to be prepared and know what to do in the event of losing one – or all – of their devices. >Backing up and synchronising passkeys with a Credential Manager makes it easier to recover access to them compared to other existing second factor options. However, this relies on the user having prepared their Credential Manager account for recovery. Users need help in understanding and implementing the right steps so they can feel ready to go passwordless and use passkeys without extra worry and hassle.

burnte 11mo ago
Just not having the right device with you is crippling. IMO Passkeys need more work. I'd really like to see accounts support multiple passkeys. I'd prefer biometrics that are device independent. I just don't like the idea of replacing something someone can steal (a password) with something else someone can steal (a phone).
- tzs 11mo ago
  > I'd really like to see accounts support multiple passkeys Most accounts seem to. Personally, I think I've only found one or two out of around 25 that I've added passkeys to that would not let me add more.
- torstenvl 11mo ago
  Would be nice, but biometrics have also been systematically made less secure. Apple, for example, no longer sells a phone with Touch ID.
  - burnte 11mo ago
    Vendors not using biometrics well doesn't mean biometrics are insecure. Apple not selling touch ID CERTAINLY isn't evidence of the security of biometrics.

JohnFen 11mo ago

I'm glad that someone is at least seriously talking about these problems. A couple of them are serious enough to make passkeys a real pain in the butt for me. A big enough one that the whole scheme is a nonstarter.

lknuth 11mo ago

Speaking of passkeys, could they be used to authenticate to a local application - say for unlocking a password vault (perhaps through a Yubikey)?

angry_octet 11mo ago
They could, it's just an API.
shortsunblack 11mo ago
Yes. HMAC extension allows for this use case.
dist-epoch 11mo ago
Probably not. But YubiKey supports multiple protocols, one of them surely could work for your use case.

runningmike 11mo ago

“Passkeys are the future of authentication” …this is not the future I hope….When Google, Microsoft and a lot of other B*G-Tech companies promote Passkeys, you know it is not done to protect your security and privacy. Nice read https://techrights.org/n/2025/05/02/Passkeys_Are_Vendor_Lock_in_and_Imperialism_Not_Security_So_Esc.shtml https://techrights.org/n/2025/05/02/Passkeys_Are_Vendor_Lock...

g-clef 11mo ago

Until passkeys can pass the test of "my non-technical friends and family don't call me for help about them", passkeys aren't ready. Vendors keep making assumptions about how users behave which are not safe assumptions, and that keeps blowing up the interactions of non-technical users. (I'm sure there's an "assumptions developers make about user accounts" blog out there somewhere.) For example, my family has had to call me for help on the interaction between passkeys on Apple & Amazon multiple times. They have a shared Amazon account, which neither Amazon nor Apple seem to like. The first problem came when they didn't even know they'd been moved to passkeys - there was a popup that one of them didn't understand, they clicked OK to get it to go away, and suddenly the other partner can't log in, and neither of them can figure out how to log into Prime Video on their AppleTV. Another time one of them got "nudged" to add a fingerprint to the account, again freezing out the other person. Until that nonsense stops happening, Passkeys aren't ready.

stavros 11mo ago
By that metric, passwords are even less ready, as I seem to always have to field calls for passwords getting stolen or compromised or accounts getting phished. I guess we're back to faxing ID.
- rekabis 11mo ago
  I have a non-technical father with dementia, and passwords+TOTP are almost frictionless for him, with minor exceptions. We are able to share around passwords and TOTP codes without any problems so I can properly monitor his online activities to keep him out of trouble. He’s a cranky old guy with almost zero trust, so having to input all that stuff satisfies him that security is being employed. Passcodes just freak him out.
  - stavros 11mo ago
    I think Github is basically the only good passkey implementation right now. The ideal flow should be: * Click login button * Window pops up asking you which passkey you want to use, you click the one you want * You're in Anything on top of that is just added friction, and I haven't seen many sites get it right.

noirscape 11mo ago

At its core, the main drawbacks that need to be solved for them to be a viable option are imo: * Improving OS flows. Every passkey implementer that's also an OS gets really excited about enrolling you into their proprietary clouds, and using alternate flows to respect the users wish to use their own manager is usually hidden in confusing UI forms that don't feel consistent if you don't already know what you're doing. * Device loss scenario is already mentioned, although more broadly speaking a lot of the reasons people get leery is because all three major providers (Google, Microsoft, Apple) are notorious for their near black box technical support. Losing access to one of these providers on its own is already enough to heavily disrupt the average person's life. Having your login details stored with them makes this even worse. * The FIDO Alliance Is Way Too Excited About Device Attestation And I Don't Like It. Basically the FIDO Alliance's behavior around passkeys reeks of security theater and them badgering an open source password manager for daring to let users export their passkeys in the format they preferred, rather than what the FIDO Alliance wanted (which is that passkeys must always be encrypted with a password) is telling. If they are as secure as promised, it's a bad look to start threatening device attestation as a means to get people to comply with your specific idea of security. The only real barrier right now to it outright being a thing is that Apple zeroes out the field and when Apple is the only meaningful halt to that kind of attestation, something has gone very wrong. I think passkeys are interesting, but I just flat out don't trust the FIDO Alliance with the idea. They're way too invested in big tech being good stewards of the ecosystem, which is becoming increasingly unpalatable as more and more evidence piles up that they're really bad actors on everything else. (So why should we trust them with our credentials?) The idea genuinely has value (it's literally the same kind of mechanism as SSH keys), but the hostility towards user freedom is deeply concerning and a blocker to getting people to use it. Even non-technical people seem leery of them, just because of how aggressively big tech has been pushing it.

AlexandrB 11mo ago
> * Improving OS flows. Every passkey implementer that's also an OS gets really excited about enrolling you into their proprietary clouds, and using alternate flows to respect the users wish to use their own manager is usually hidden in confusing UI forms that don't feel consistent if you don't already know what you're doing. You're kidding yourself if you think that this is something Microsoft, Apple, or Google are incentivized to solve. Microsoft is especially bad here - pushing their crappy products in Windows every chance they get. Once some marketing director gets the idea that this can improve retention in Outlook or something the UI will get more confusing and the dark patterns will get darker.

sam_lowry_ 11mo ago

How are passkeys different from API keys or just random chains of characters? And why can't we have the use of such keys enforced by an EU legislation so that all businesses allow users to login using such strings of random characters? The world would then be a better place.

gowld 11mo ago
> How are passkeys different from API keys or just random chains of characters? Passkeys are encrypyed so they can't be simply copied off your device.
- angry_octet 11mo ago
  They can most definitely be copied off the device, and the decryption key is in memory.
- sam_lowry_ 11mo ago
  So how are they better than API keys if I can not even backup them?
IcyWindows 11mo ago
Passkeys are a private key stored on your device with the public key registered with the server. Servers should allow multiple passkeys per user (so you can register multiple devices), but many don't.
- sam_lowry_ 11mo ago
  That's an implementation detail users should not care about. The bigger question is... why don't we replace the login/password combination with just a string of randomly generated characters and call it a day? Why protect these strings of random characters from users, call them passkeys and advertise them on all street corners? Feels like a devil's plot to strip us from all the rights to our devices.
  - 11mo ago

jauntywundrkind 11mo ago

Nicely timed on the one year anniversary of FIDI Alliance's Credential Exchange Protocol and Credential Exchange Format. https://fidoalliance.org/fido-alliance-publishes-new-specifications-to-promote-user-choice-and-enhanced-ux-for-passkeys/ https://fidoalliance.org/fido-alliance-publishes-new-specifi... https://news.ycombinator.com/item?id=41847787 https://news.ycombinator.com/item?id=41847787 But afaik you still can't move Passkeys from Chrome or Safari to any other credential manager. I was vaguely under the impression that there was a ton of push-back again import/export flows in general, that the CEP was going to be the only supported path. And it requires that your Credentials Manager have a public endpoint to send your credentials to. Which doesn't force but radically ups the challenge for individuals to self host or manage things themselves, will drive Passkeys to remain service provided only. With governments upping their right to snoop, immoral intercept, it's hard to have too much hope that Passkeys can remain trustable & respectable. If the UK passes a law saying they can access all your keys, the odds are not in your favor that Google is going to make a Signal like stand & tell the UK to buzz off. It's unfortunate that these giant massive enterprises are so big are so many products all in one, because if there was a healthy Chrome business not tied to thousands of other profit lines, maybe Chrome would dare have some backbone & tell their majesty to go stick it where the sun don't shine. But these companies are so big that even the most immoral outrageous ridiculous laws end up being accepted. Passkeys seems like a huge painted target; maybe the next 15-20 years go by with no one trying to get in the cookie jar, but it seems inevitable that the moral rot and illegitimacy of governments will stoop down to making this good idea untenable & a joke, in a long enough time scale. Especially with the service-provider-only ecosystem that's being engineered and imposed here.

ajnin 11mo ago

> websites which [...] also want to know how the passkey is being handled by the user’s device to keep their accounts safe This is exactly where passkeys go too far. "to keep their accounts safe" is always the excuse used to reduce the freedoms of users. Web sites have no business deciding how things are handled on user devices but it's precisely what passkeys enable. The boundary of control of a website used to stop at the interface between the site and the user. Now that boundary will extend to the devices. The idea of property and ownership is attacked again. The device is not something the user owns and has full control over but something that is a gateway to access content controlled by the big Internet companies. Knowing this, how long until Netflix, Disney other content providers (sorry I don't know which ones are popular right now) demand use of a passkey originating form a device with a Trusted Platform (aka Untrusted User) Module ? This is part of a long plan initiated years ago with Windows TPM requirements, Microsoft account requirements. The gap between closed and open platforms will widen and the path is clearly to apply the Smartphone model where everything is closed, controlled, DRM'd, to other computers. We're lucky the IBM PC architecture was an open one but the war on that is on.

stavros 11mo ago
I've seen this argument many times, but I don't understand it. Can you explain a scenario where this would be an issue? So, Netflix makes me log in with a passkey that comes from their own hardware, instead of my password manager. What's the danger there, beyond the fact that this seems to me extremely unworkable because I'd just never sign in?
- array_key_first 11mo ago
  The danger is that you now can no longer use netflix without they're approved hardware? Of course, that's essentially already the case with netflix, but this becomes dicey when services that actually matter take this approach. And then suddenly you're debanked.
  - stavros 11mo ago
    No, we're talking about logins, not usage. Can someone explain to me a case where logging in only with an approved authenticator would be problematic?

djoldman 11mo ago

> Users are largely unsure about the implications for their passkeys if they lose or break their device, as it seems their device holds the entire capability to authenticate. To trust passkeys as a replacement for the password, users need to be prepared and know what to do in the event of losing one – or all – of their devices. > Backing up and synchronising passkeys with a Credential Manager makes it easier to recover access to them compared to other existing second factor options. However, this relies on the user having prepared their Credential Manager account for recovery. Users need help in understanding and implementing the right steps so they can feel ready to go passwordless and use passkeys without extra worry and hassle. The benefit to the user of a passkey is that they don't have to remember passwords ("what you have" and not "what you know"). But if you lose what you have, you're screwed. There's no straightforward way to mitigate this. Proposed solutions I've seen just add an extra layer of "what you know," but this just changes the security back to "what you know" if it supersedes the passkey.

supportengineer 11mo ago

Passkeys are great because they get sync'ed to all your devices, which makes it really easy to share access to those websites with other people ( who have access to devices on your account ). Like a spouse.

marssaxman 11mo ago
What mechanism makes that happen?
- deleted 11mo ago
  [deleted]
angry_octet 11mo ago
This is also a problem because the security boundary of passkey security is now the entire cloud of that provider... And every app on every device you're logged in to.
Bolwin 11mo ago
Uh huh. And what if they don't? Or what if they do but would rather user their own device. Or what if they don't right now? You know what's even easier? Sending them the password.
Mindwipe 11mo ago
> Passkeys are great because they get sync'ed to all your devices, which makes it really easy to share access to those websites with other people ( who have access to devices on your account ). Like a spouse. They certainly fucking don't. I also have no interest in my credentials touching any cloud whatsoever.

eric1west 11mo ago

[flagged]

donald6 11mo ago

[flagged]

smthglbert7 11mo ago

[dead]